User Profile
NoobieInfoSec
Copper Contributor
Joined 4 years ago
User Widgets
Recent Discussions
Using IIS Crypto Tool on Windows 10 Enterprise Workstations?
I have a few Windows 10 enterprise workstations (not servers) that we use RDP on. Running a Nessus scan on these machines shows some medium to high cryptography vulnerabilities (Deprecated TLS and weak cipher suites, vulnerable to sweet 32) on port 3389 for RDP. My research tells me that one way to remediate this is to use the IIS Crypto tool. This tool was made for windows server, but can I still use it on workstations? Or is there another way I should do this?Risky Sign-in Report - Where to see or adjust the settings?
We are seeing some inconsistencies with our Risky Sign-in reports. For example, we'll have multiple users who travel over seas, logging in from foreign IP addresses for the first time, and some will get flagged as a risky sign in while others won't. We had one US based user in particular who travelled in Eastern Europe for a month and was never flagged for risky sign ons. Is there a way to see and or adjust the settings/criterion for how the risky sign-in reports work?Ability to calibrate or see Risky Sign-in Report Logic?
We are seeing some inconsistencies with our Risky Sign-in reports. For example, we'll have multiple users who travel over seas, logging in from foreign IP addresses for the first time, and some will get flagged as a risky sign in while others won't. We had one US based user in particular who travelled in Eastern Europe for a month and was never flagged for risky sign ons. Is there a way to see and or adjust the settings/criterion for how these reports work?Microsoft Sentinel Potentially malicious events - Flagging as Safe/Informational?
Is there a way to change the status of a potentially malicious event as safe so it no longer shows up on the map? Also, is there a way to create some logic in Sentinel to say if any activity comes from a specific IP Address (like the one showing up in the potentially malicious event) to NOT show up on the map and instead just give an informational alert that it happened? I started to try and create a rule to do this (see below) but not sure if I'm going about it the correct way.
